Privacy Policy

1. Introduction

This Privacy Policy describes how Shog Consulting (FZC), licence number SC242038101, of Airport Road, Abu Dhabi, United Arab Emirates ("Shog", "we", "us") collects, uses and protects personal information through the Shog Consulting & Corporate Training Platform ("Platform"). By using the Platform, you agree to the practices described in this policy.

2. Information We Collect

We collect the following types of information when you use the Platform:

• Account information: company name, your full name, email address, and authentication credentials.
• Attendee data: full names, email addresses, department, job title, employee ID, and phone number as provided by your company for training enrollment.
• Training data: course enrollment records, assessment scores, completion dates, and certificate details.
• Identity verification: selfie photographs captured during training completion for certificate verification purposes.
• Usage data: browser type, access times, and pages viewed for platform improvement and security monitoring.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To deliver training content, manage enrollments, and track course progress.
• To issue training completion certificates and manage certificate validity.
• To process enrollment payments through our payment provider.
• To generate compliance reports and training evidence for your company.
• To send service-related communications such as training course links, enrollment confirmations, and certificate notifications.

4. AI Assistant Connections

Only the account owner can approve an external AI connection. Each connection covers one company; separately approved account-course permissions cover private courses across the account. Permissions can allow training queries, routine employee edits and preparation of employee, assignment and course requests. Consequential requests require review inside Shog. Connections cannot access credentials, complete learner evidence, publish courses or silently charge a payment method.

When someone using the connected assistant asks about the company's training, the assistant can read employee records (such as names, email addresses and job details), courses, enrolments and module progress, and certificates with their verification links. What it reads is sent to the assistant's provider, whose own terms and privacy policy govern how that provider handles it.

We retain safe operation metadata for 30 days, without conversation transcripts or personal tool payloads in activity logs. Proposed changes and per-item results are encrypted separately to support review and recoverable execution. Pending requests expire after 24 hours. Housekeeping purges expired, rejected and invalidated proposal payloads and temporary uploads; completed request payloads are retained for up to 30 days. Accepted course documents follow existing course retention rules.

The account owner can end a connection at any time from Integrations in Shog, and it stops working immediately.

Ask Shog: help inside the workspace

When you use Ask Shog, we send your question, up to four recent exchanges, generic screen and role context, and relevant published help passages to OpenAI to prepare an answer. We do not automatically send company records, employee details, form contents or account names. The assistant cannot inspect your company records or perform actions. Do not include confidential information or credentials in your questions.

The conversation is held in browser memory and clears on refresh, sign-out or a company/language change. Shog does not save conversation text in its database or logs. We retain request identifiers, user/account identifiers, model, token counts, cost, timing and outcomes for 30 days for usage controls and operation. We request that responses are not stored by OpenAI, but its applicable abuse-monitoring retention may still include content, generally for up to 30 days, with policy exceptions. Guides remain available without AI processing.

5. Data Retention

We retain training records, certificates, and associated data for as long as necessary to fulfill compliance requirements and the purposes described in this policy. You may request deletion of your personal data at any time, subject to applicable legal and regulatory retention obligations.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Personally identifiable information (PII) is encrypted at rest using AES-256-GCM encryption.
• All data transmitted between your browser and our servers is protected using TLS encryption.
• Multi-factor authentication (MFA) is required for all administrator accounts.
• Each company's data is kept separate, and only the people that company has authorised can reach it.

7. Your Rights

In accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you have the following rights:

• Right to access your personal data held by us.
• Right to request correction of inaccurate or incomplete data.
• Right to request deletion of your personal data, subject to legal retention requirements.
• Right to request a copy of your data in a portable format.

8. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact Shog Consulting (FZC) at training@shogconsulting.com, or by post at Airport Road, Abu Dhabi, United Arab Emirates.